arpwatch

Problem

I am running arpwatch-2.1a13-10.RHEL4, obtained with CentOS 4.5 (a re-spin of RHEL 4.5).

I am trying to include two additional networks to monitor, in addition to the default local network.

I am invoking arpwatch as so:

arpwatch -i eth0 -u pcap -e my@email.address -s root (Arpwatch) -n a.b.c.d/25 -n e.f.g.h/27

However, arpwatch is still reporting bogons in e.f.g.h/27:

Apr 24 10:46:56 saturn arpwatch: bogon e.f.g.139 0:a0:cc:d3:2f:b2
Apr 24 10:47:48 saturn arpwatch: bogon e.f.g.132 0:f:66:4f:15:25
Apr 24 10:47:52 saturn arpwatch: bogon e.f.g.136 0:4:5a:8a:25:54
Apr 24 10:50:59 saturn arpwatch: bogon e.f.g.136 0:4:5a:8a:25:54

• […] –n a.b.c.d/25 e.f.g.h/27
• […] –n a.b.c.d/25,e.f.g.h/27

The man page is perhaps ambiguous when describing –n: The -n flag specifies additional local networks.

It implies that more than one additional network can be specified but does not elaborate on how this might be accomplished.